v1.8.4

Date: August 28, 2026

Breaking changes

• The SDS (Secret Discovery Service) reference secret url field must now include the unix:// scheme (e.g. unix:///var/run/secrets/workload-spiffe-uds/socket). Bare filesystem paths that were previously accepted are now rejected and must be updated.
• OCI Wasm image pulls now require the registry to serve HTTPS. The implicit fallback to plain HTTP has been removed, so a Wasm extension backed by a plain HTTP registry will fail to load unless that registry is explicitly configured as insecure.
• HTTP is no longer supported as an OIDC issuer URL scheme.

Security updates

• Enabled AES-256-GCM encryption for OAuth2/OIDC session cookies and disabled the legacy AES-256-CBC decryption path in the Envoy proxy bootstrap, addressing the padding oracle in CVE-2026-47775. Existing OIDC sessions were encrypted with AES-256-CBC and are no longer accepted, so users with an active session are redirected to re-authenticate once after upgrading. This is set in the default bootstrap, so an EnvoyProxy using spec.bootstrap with type Replace (the default when no type is given) does not receive it; OIDC users with a replacement bootstrap must add envoy.reloadable_features.oauth2_use_gcm_encryption: true and envoy.reloadable_features.oauth2_legacy_cbc_decrypt_compat: false to a layered_runtime static layer themselves.
• Fixed OCI Wasm image pulls silently downgrading to plain HTTP when the registry rejected the HTTPS request, which allowed an on-path attacker to serve arbitrary Wasm code to the Envoy proxies. Plain HTTP is now used only for registries that are explicitly configured as insecure.
• Fixed a nil pointer dereference in SecurityPolicy translation for TCPRoutes: a listener with no corresponding xDS IR entry (for example, a Gateway listener marked Conflicted for sharing a port with another listener) could panic the control plane during translation, silently dropping that reconcile’s IR and status publication.
• Fixed a confused-deputy/PSA-escape issue (GHSA-w42f-28h3-998w) where a tenant-supplied KubernetesContainerSpec.SecurityContext on an EnvoyProxy replaced Envoy Gateway’s hardened default SecurityContext outright instead of merging on top of it, allowing a tenant whose EnvoyProxy is materialized in the shared controller namespace to drop restrictions (e.g. run privileged or as root) that the controller namespace’s Pod Security Admission would otherwise enforce.
• Added validation for the OIDC issuer URL configured in SecurityPolicy.
• Fixed a control-plane availability issue in EnvoyExtensionPolicy Wasm OCI permission handling.
• Bumped envoy to 1.38.4.
• Bumped Go to 1.26.7.

New features

Bug fixes

• Fixed deduplicate CA certificates in ClientTrafficPolicy mTLS.
• Added validation for the SDS (Secret Discovery Service) cluster URI to ensure Unix Domain Socket (unix://) URLs are well-formed, rejecting a host component and requiring a path, instead of silently producing an invalid or unintended socket address.
• Fixed Gateway TLS Secret validation rejecting valid ECDSA private keys when the tls.key includes an EC PARAMETERS PEM block before the private key.
• Fixed route and policy status never being written under high watch-event churn. When the informer cache lagged behind the API server, the status updater’s cache-backed Get could return NotFound for a freshly-created object and silently skip the status write, leaving the object with an empty status until a controller restart. The status updater now confirms a NotFound against an uncached reader before dropping the update.
• Fixed Envoy Gateway crash-looping at startup on clusters whose Gateway API CRD bundle omits ListenerSet, GRPCRoute or TLSRoute, such as GKE’s managed gateway-api-crds addon, by making those watches conditional on the CRD being present.
• Fixed Envoy Gateway overriding the replica count computed by an HPA. The proxy and rate limit Deployments are applied with server-side apply using ForceOwnership, so rendering spec.replicas made envoy-gateway the owner of that field and every subsequent reconciliation reset the replica count to the statically configured value. The replicas field is now omitted from the generated Deployment when an HPA is configured (envoyHpa / rateLimitHpa), which is the behavior already documented for both. Use minReplicas to set a lower bound on the replica count instead.
• Fixed Envoy Gateway crash-looping at startup on clusters whose Gateway API CRD bundle omits BackendTLSPolicy, such as OpenShift’s Ingress-Operator-managed set, by making that watch conditional on the CRD being present.
• Fixed ListenerSet not being reconciled when a referenced TLS Secret is created or updated after the ListenerSet. Secret watches previously only indexed Gateway certificateRefs, so cert-manager style late Secret creation left the ListenerSet stuck with Programmed=False until an unrelated reconcile.
• Fixed ConsistentHash load balancing not pinning a client to a single backend when a route splits traffic across multiple weighted backendRefs. Envoy Gateway now sets use_hash_policy on the generated weighted clusters when a ConsistentHash load balancer is configured, so the request’s hash policy selects the weighted cluster deterministically instead of at random per request.
• Fixed HTTPRoute (and other xRoute) acceptance not being re-evaluated when a namespace’s labels changed to newly match, or stop matching, a Gateway listener’s allowedRoutes.namespaces.from: Selector, requiring a controller restart to pick up the change. Envoy Gateway now watches Namespace label updates and re-reconciles affected Gateways automatically.
• Fixed OIDC flow-state cookies accumulating in the browser and overflowing the request header size limit. Envoy mints a nonce (CSRF) and a PKCE code verifier cookie for every authorization flow it starts, but only deletes the pair belonging to the flow that completes the callback, so flows that are abandoned - parallel requests from a logged out browser, a user navigating away from the provider’s login page - leave their cookies behind until they expire. Envoy Gateway now scopes both cookies to the OIDC redirect path, the only path where Envoy needs their value, so any orphans are no longer sent on every request. Note this bounds the damage rather than eliminating it: orphans are still sent to the callback endpoint itself until they expire, and logout can no longer purge them early because the browser no longer sends them to the signout path, so also consider lowering csrfTokenTTL. The PKCE code verifier cookie is also now named CodeVerifier-<suffix>, carrying the same per-policy suffix as the other OAuth2 cookies instead of Envoy’s shared default, so SecurityPolicies on the same cookie domain no longer delete each other’s in-flight flow cookies on logout. On upgrade, a browser already holding flow cookies keeps them at the old path=/, since the new deletion headers are scoped to the redirect path. They expire on the lifetime they were originally issued with - 10 minutes by default, and unaffected by any csrfTokenTTL you configure during the upgrade. The old code verifier cookie name is also no longer read, so a login that was in progress across the rollout may need to be retried once.
• The global rate limit cluster is now built from the in-cluster envoy-ratelimit Service/EndpointSlices using EDS instead of resolving a static DNS hostname, so requests keep hitting rate limit service replicas correctly as they scale up or down. When the Service or its endpoints can’t be discovered, Envoy Gateway falls back to the previous STRICT_DNS behavior.
• Fixed the File and ALS access log sinks silently falling back to the default JSON fields when telemetry.accessLog.settings[].format sets text without type, which the API accepts.
• Fixed a BackendTrafficPolicy setting a ConsistentHash load balancer having no effect when it targets a UDPRoute. The cluster was configured with Maglev, but no hash policy was set on the UDP proxy listener filter, so Envoy had no hash key to compute and fell back to picking an upstream host at random for every UDP session. The source IP hash policy is now configured on the UDP proxy. Only the SourceIP consistent hash type applies to UDP, since headers, cookies and query parameters do not exist in a UDP datagram.
• Fixed the controller crash-looping when an extension manager’s backendResources references a CRD that is not installed in the cluster. The CRD existence is now checked once at controller startup and cached in a field on the reconciler, following the same pattern already used for ServiceImport, Backend, and other optional CRDs. When the CRD is absent, both the watch and the reconcile list path are skipped; all other errors from the list call are returned so the reconcile is retried instead of publishing an incomplete resource snapshot.
• Fixed the Wasm image permission cache key omitting the CA certificate, which allowed a permission check result to be reused across different TLS trust configurations.
• Fixed controller panic when translating backend credential injection with an invalid header.

Performance improvements

• Fixed translation latency growing quadratically when many policies share the same target by capping each policy’s status.ancestors at the CRD limit as ancestors are added, instead of only truncating during post-processing.
• Improved reconcile performance by listing the extension manager’s resources and backendResources once per GatewayClass instead of once per Gateway.

Deprecations

Other changes

• Bumped ratelimit to 8fe6ea42.
• Added per-phase tracing spans to the Gateway API and xDS translators, each recording the size of the input it processed, so that a slow translation can be attributed to a specific phase — listener processing, HTTP and gRPC route processing, the main policy types, EnvoyPatchPolicy JSON patches, extension server hooks, and xDS resource validation — instead of showing up as one opaque multi-second span.